apache/beam · error · java.lang.RuntimeException

Missing credentials values. Please check your credentials

Error message

Missing credentials values. Please check your credentials

What it means

When building the Snowflake BasicJdbcDataSource, if neither a private key + username nor a username + password pair is configured, SnowflakeIO throws RuntimeException('Missing credentials values. Please check your credentials'). Snowflake requires one complete authentication credential set.

Solutions

Provide .withUsername(...) together with .withPassword(...) on the SnowflakeIO transform.
Or provide .withUsername(...) with .withPrivateKey(...) / key file for key-pair authentication.
Verify ValueProviders/options actually resolve to non-empty values (log or assert before expanding).
Store secrets in a secret manager and inject them rather than hardcoding, ensuring the value is present at runtime.

Example fix

// before
SnowflakeIO.<KV<String,String>>read().withDataSourceConfiguration(dsCfg); // dsCfg has only account/db, no user/pass
// after
DataSourceConfiguration dsCfg = DataSourceConfiguration.create(account, database)
    .withUsername("user").withPassword("secret");

Defensive patterns

Strategy: validation

Validate before calling

if ((username == null || username.isEmpty()) || ((password == null || password.isEmpty()) && (privateKey == null || privateKey.isEmpty()))) {
  throw new IllegalArgumentException("Provide username plus either password or privateKey for Snowflake");
}

Try / catch

try {
  pipeline.apply(SnowflakeIO.read()...);
} catch (RuntimeException e) {
  if (e.getMessage().contains("Missing credentials")) {
    throw new IllegalStateException("Check username/password/privateKey pipeline options", e);
  }
  throw e;
}

Prevention

Always set username alongside password or privateKey.
Verify ValueProviders resolve before expand().
Inject secrets from a secret manager and assert non-empty at startup.

When it happens

Trigger: Building a SnowflakeIO read/write where username is set but password and privateKey are both absent; password set without username; nothing authentication-related set at all.

Common situations: Password stored in pipeline options that resolved to null/empty (e.g. missing secret, ValueProvider not populated); using OAuth token without wiring it through this code path; credentials left out when moving from local test to Dataflow.

Related errors

AI-assisted analysis of apache/beam@12126d8942 (2026-09-13). Data as JSON: /api/errors/35f66f720c550458. Report an issue: GitHub.

Appendix: source

Thrown at sdks/java/io/snowflake/src/main/java/org/apache/beam/sdk/io/snowflake/SnowflakeIO.java:1849

        SnowflakeDataSource dataSource = SnowflakeDataSourceFactory.createDataSource();
        dataSource.setUrl(buildUrl());

        if (isNotEmpty(getOauthToken())) {
          dataSource.setToken(getOauthToken().get());
        } else if (isNotEmpty(getUsername()) && getPrivateKey() != null) {
          dataSource.setUser(getUsername().get());
          dataSource.setPrivateKey(getPrivateKey());
        } else if (isNotEmpty(getUsername()) && isNotEmpty(getRawPrivateKey())) {
          PrivateKey privateKey =
              KeyPairUtils.preparePrivateKey(
                  getRawPrivateKey().get(), getValueOrNull(getPrivateKeyPassphrase()));
          dataSource.setPrivateKey(privateKey);
          dataSource.setUser(getUsername().get());
        } else if (isNotEmpty(getUsername()) && isNotEmpty(getPassword())) {
          dataSource.setUser(getUsername().get());
          dataSource.setPassword(getPassword().get());
        } else {
          throw new RuntimeException("Missing credentials values. Please check your credentials");
        }

        if (isNotEmpty(getAccount())) {
          dataSource.setAccount(getAccount().get());
        }
        if (isNotEmpty(getDatabase())) {
          dataSource.setDatabaseName(getDatabase().get());
        }
        if (isNotEmpty(getWarehouse())) {
          dataSource.setWarehouse(getWarehouse().get());
        }
        if (isNotEmpty(getSchema())) {
          dataSource.setSchema(getSchema().get());
        }
        if (isNotEmpty(getServerName())) {
          dataSource.setServerName(getServerName().get());
        }
        if (getPortNumber() != null) {

View on GitHub (pinned to 12126d8942)